How to source training data in ML for information security?
You have implicitly assumed that supervised learning is being used, given the assumption that labels are needed. But this might lead to the following potential problems:

Log file data tends to be huge, and it may be infeasible to label due to the time/expertise required;
Then there's the class imbalance problem, in that attack examples are far far rarer than &quot;normal&quot; behaviour, and this can mess up supervised models during both learning and evaluation stages;
And finally even if the data is labelled, a supervised model is unlikely to be useful in detecting completely novel attacks because it has not been trained to recognise these.

I think a far easy way to approach these kinds of problem would be unsupervised learning: model normal patterns and behaviours in the logs, and then flag any deviations from normality. It may be an attack or it may be new normal behaviour. In the latter case, the model can be updated. There are various approaches here such as clustering, outlier detection and possibly self-supervised learning that might be useful. Dimensionality techniques might also be useful to visualise clusters of &quot;normal&quot; behaviour that can be compared to abnormal patterns.